Using the certutil Utility

Before running certutil, make sure that LD_LIBRARY_PATH points to the location of the libraries required for this utility
to run. This location can be identified from the value of AS_NSS_LIB in asenv.conf (product wide configuration file).

The certificate database tool, certutil, is an NSS
command-line utility that can create and modify the Netscape Communicator cert8.db and key3.db database files. It can also
list, generate, modify, or delete certificates within the cert8.db file
and create or change the password, generate new public and private key pairs,
display the contents of the key database, or delete key pairs within the key3.db file.

The key and certificate management process generally begins with creating
keys in the key database, then generating and managing certificates in the
certificate database. The following document discusses certificate and key
database management with NSS, including the syntax for the certutil utility: http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html.

Each of the items in the list below gives an example using NSS and JSSE
security tools to create and/or manage certificates.

Generate a self-signed server and client certificate. In this
example, the CN must be of the form hostname.domain.[com|org|net|...].

In this example, domain-dir/config. The serverseed.txtand clientseed.txt files can contain
any random text. This random text will be used for generating the key pair.